Main menu

I haven’t post here from a lonnnng time… And i restart to explain a quick trick.

Few days ago, i search how to extract a malware from a malware defender quarantine files. A friend tell me, it’s encrypted by a RC4 and he give me the key. I have made a script to automatise that: MalwareDefenderDecrypter

The output is quite dirty, there is some bytes (probably headers) to remove until the MZ.

Forward the debug port (23946), for use it on your local machine, now android_server port is just bind on your lo interface, it’s not accessible from an other interface, and you can’t use iptable to forward it. But redir can!

Coded in C++, it run as a daemon, after, it lauch _ZN9CStatBase10InitializeEv who get some system infos.

_ZN9CStatBase13GetSysVersionEv do a uname command.
_ZN9CStatBase9GetCpuSpdEv get cpu info to /proc/cpuinfo and extract frequency.
__ZN9CStatBase13InitGetCPUUseEv open /proc/stat file and check cpu usage.
_ZN9CStatBase13InitGetNetUseEv open /proc/net/dev and get network informations.

After that it initialize the server:

Lock at the decrypt fonction:

Decrypt fonction as call twice, one with the argument 281-206-3//18 (the C&C ip adress?), decrypt value is 190.115.20.27, and after with 68961 as the port number 59870.

Not necesseray to make a script to reverse this fonction, we can see decrypt values in memory, but this function is easy to understand, it make one ascii addition of the crypted value, after ascii soustraction and loops.
# netstat -laputen
Connexions Internet actives (serveurs et établies)
Proto Recv-Q Send-Q Adresse locale Adresse distante Etat User Inode PID/Program name
tcp 4 0 192.168.1.69:46730 190.115.20.27:59870 ESTABLISHED 1000 138545 18345/disknyp

Localisation of the c&c:

Belize, it’s not the right place for make malware, but rather to jump into the see and drink mojitos 🙂

After, it call _ZN8CManager15StartNetProcessEv fonction, who create a thread, initialize a socket, and send information.

And it create an fake.cfg file, it’s containt the ip adress of my hosts, corresponding for me to the local adress.
$ cat fake.cfg
0
127.0.1.1:127.0.1.1
10000:60000

After it read /proc/stat and /proc/net/dev file and just send kernel version to the c&c in loop.